
United States Patent and Trademark Office 



UNITED STATES DEPARTMENT OF COMMERCE 
United States Patent and Trademark Office 
Addresr COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Wiguria 223)3-1450 
www.uxptogov 



APPLICATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. 



CONFIRMATION NO. 



09/557,708 



04/25/2000 



Christopher A. S. Gage 



RSW9-2000-0039-US1 



8638 



25259 7590 09/30/2003 

IBM CORPORATION 

3039 CORNWALLIS RD. 

DEPT. T81 / B503, PO BOX 12195 

REASEARCH TRIANGLE PARK, NC 27709 



EXAMINER 



BAUGH, APRIL L 



ART UNIT 



PAPER NUMBER 



2141 

DATE MAILED: 09/30/2003 



T> 



Please find below and/or attached an Office communication concerning this application or proceeding. 



PTO-90C (Rev. 07-01) 



Office Action Summary 



Application No. 

09/557,708 



Examiner 

April L Baugh 



Applicant(s) 

GAGE ET AL 



Art Unit 

2141 



« The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply wilt, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )□ Responsive to communication(s) filed on . 



2a)D This action is FINAL. 2b)M This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quay/e, 1935 CD. 11, 453 O.G. 213. 
Disposition of Claims 

4) S Claim(s) 1-27 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) I3 Claim(s) 7-27 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

1 1) D The proposed drawing correction filed on is: a)D approved b)D disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) D The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

13) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(aHd) or(f). 

a)DAII b)D Some*c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121. 

Attachment(s) 

1 ) [3 Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) Paper No(s). . 

2) EH Notice of Drattsperson's Patent Drawing Review (PTO-948) 5) □ Notice of Informal Patent Application (PTO-152) 

3) □ Information Disclosure Statement(s) (PTO-1449) Paper No(s) . 6) □ Other: 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 04-01) 



Office Action Summary 



Part of Paper No. 9 



Application/Control Number: 09/557,708 
Art Unit: 2141 



Page 2 



DETAILED ACTION 

Response to Amendment 

Claims 1-27 are now pending. 

Response to Arguments 

1 . Applicant's arguments with respect to claims 1-27 have been considered but are moot in 
view of the new ground(s) of rejection. 

Claim Rejections - 35 USC §103 

1 . The following is a quotation of 35 U.S.C 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claim 1, 2, 6, 7, 12, 13, 17, 18, 22, 23, and 27 rejected under 35 U.S.C. 103(a) as being 
unpatentable over US Patent No. 6,076,108 to Courts et al. in view of Eldridge et al. (6,515,988) 

Regarding claim 1, Courts et al. teaches a method of establishing a persistent relationship 
between an end user device and a server where the server is one of a plurality of servers managed 
by a dispatcher (column 3, lines 5-7 of Courts et al.) and the end user device accesses the server 
using a universal resource locator (URL) (column 5, lines 66-67 of Courts et al.), the method 
comprising the steps of: receiving, at the dispatcher, a request for information from the end user 
device; determining, by the dispatcher, which of the plurality of servers to select for satisfying 
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the request (column 3, lines 5-7 and column 5, lines 66-67 of Courts et al.); said key for 
accessing a storage area for information regarding the persistent relationship and the end user 
device (column 1, lines 45-50 of Courts et al.). 

Courts et al. does not teach of creating a token. Eldridge et al. (6,515,988) teaches 
creating, at the selected server, a token comprising at least an identifier for the selected server, a 
date/time stamp, and a key, inserting the token into the URL; and, sending, by the selected server 
to the client device, a response with the token inserted into the URL (column 1, lines 53-67 and 
column 9, lines 29-37 of Eldridge et al. (6,515,988)). Therefore it would have been obvious to 
one of ordinary skill in the art at the time the invention was made to further modify the method 
for maintaining a state for a user session using a global session server by Courts et al. by creating 
a token because this notifies the system of the type of encryption information to use to encrypt 
the packet. 

Referring to claim 2, 13, and 23, Courts et al. teaches a method [a computer program 
product and a network dispatcher] as claimed in claim 1,12, and 22 (column 3, lines 5-7 of 
Courts et al). 

Courts et al. does not teach of encoding tokens using a modified Base64 encoding. 
Eldridge et al. (6,515,988) teaches wherein said token is encoded using a modified Base64 
encoding (column 7, lines 9-16 of Eldridge et al. (6,515,988)). Therefore it would have been 
obvious to one of ordinary skill in the art at the time the invention was made to further modify 
the method for maintaining a state for a user session using a global session server by Courts et al. 
by encoding tokens using a modified Base64 encoding because this Base64 is one of many 
encryption methods. 
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Referring to claim 7, Courts et al. teaches a method of routing a request by an end user 
device to a particular one of a plurality of redundant servers residing behind a network 
dispatching mechanism (column 3, lines 5-7 and column 6, line 5 of Courts et al.), said methods 
comprising the steps of: receiving, at the network dispatching mechanism, a request for 
information indicated by a uniform resource locator (URL) (column 5, lines 66-67 of Courts et 
al); further determining, at the network dispatching mechanism, if a session binding is old 
(column 6, line 45 of Courts et al.); forwarding, by said network dispatching mechanism, the 
request, including the URL, to the particular server (column 3, lines 5-7 and column 6, line 5 of 
Courts et al); removing, by said particular : server, said valid routing information from the URL; 
storing, by said particular server, routing information removed from said valid routing token, 
where said valid routing information can be accessed subsequently by an outbound data stream 
filter during the processing of an outbound reply related to said request (column 1, lines 48-53 of 
Courts et al.); accessing, by said particular server, a storage location where information regarding 
a session between the particular server and the end user device is stored; and inserting, by said 
particular server, said session information into said request (column 1, lines 52-55 of Courts et 



Courts et al. does not teach of tokens. Eldridge et al. (6,515,988) teaches determining, at 
the network dispatching mechanism, if said URL contains a valid routing token; if said URL 
contains a valid routing token and said routing token is not old, forwarding, by said network 
dispatching mechanism, the request, including the URL, to the particular server indicated by said 
valid routing token (column 1, lines 53-67 and column 6, lines 63-67 and column 9, lines 25-37 
of Eldridge et al. (6,515,988)). Therefore it would have been obvious to one of ordinary skill in 



al). 
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the art at the time the invention was made to further modify the method for maintaining a state 
for a user session using a global session server by Courts et al. by having a routing token because 
this notifies the system of the type of encryption information to use to encrypt the packet and the 
validity of the packet. 

Regarding claim 12, Courts et al. teaches a computer program product having computer 
readable code means (column 1, lines 18-20 of Courts et al) of establishing a persistent 
relationship between an end user device and a server where the server is one of a plurality of 
servers managed by a dispatcher (column 3, lines 5-7 of Courts et al.) and the end user device 
accesses the server using a universal resource locator (URL) (column 5, lines 66-67 of Courts et 
al), the computer program product comprising: computer readable code means of receiving, at 
the dispatcher, a request for information from the end user device; computer readable code 
means of determining, by the dispatcher, which of the plurality of servers to select for satisfying 
the request (column 3, lines 5-7 and column 5, lines 66-67 of Courts et al.); said key for 
accessing a storage area for information regarding the persistent relationship and the end user 
device (column 1, lines 45-50 of Courts et al.). 

Courts et al. does not teach of creating a token. Eldridge et al. (6,515,988) teaches 
computer readable code means of creating, at the selected server, a token comprising at least an 
identifier for the selected server, a date/time stamp, and a key, computer readable code means of 
inserting the token into the URL; and, computer readable code mans of sending, by the selected 
server to the client device, a response with the token inserted into the URL (column 1, lines 53- 
67 and column 9, lines 29-37 of Eldridge et al. (6,515,988)). Therefore it would have been 
obvious to one of ordinary skill in the art at the time the invention was made to further modify 
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the method for maintaining a state for a user session using a global session server by Courts et al. 
by creating a token because this notifies the system of the type of encryption information to use 
to encrypt the packet. 

Regarding claim 18, Courts et al. teaches a computer program product having computer 
readable program code (column 1, lines 18-20 of Courts et al.) for routing a request by an end 
user device to a particular one of a plurality of redundant servers residing behind a network 
dispatching mechanism (column 3, lines 5-7 and column 6, line 5 of Courts et al.), said program 
product comprising: computer readable program code for receiving, at the network dispatching 
mechanism, a request for information indicated by a uniform resource locator (URL) (column 5, 
lines 66-67 of Courts et al.); if said URL contains a valid routing token, computer readable 
program code for determining, at the network dispatching mechanism, if a session binding 
indicated by said routing token is old (column 6, line 45 of Courts et al.); computer readable 
program code for forwarding, by said network dispatching mechanism, the request, including the 
URL, to the particular server (column 3, lines 5-7 and column 6, line 5 of Courts et al.); 
computer readable program code for removing, by said particular server, said valid routing 
information from the URL; computer readable program code for storing, by said particular 
server, routing information removed from said valid routing token, where said valid routing 
information can be accessed subsequently by an outbound data stream filter during the 
processing of an outbound reply related to said request (column 1, lines 48-53 of Courts et al.); 
computer readable program code for accessing, by said particular server, a storage location 
where information regarding a session between the particular server and the end user device is 
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stored; and computer readable program code for inserting, by said particular server, said session 
information into said request (column 1, lines 52-55 of Courts et al). 

Courts et al. does not teach of tokens. Eldridge et al. (6,515,988) teaches computer 
readable program code for determining, at the network dispatching mechanism, if said URL 
contains a valid routing token if said URL contains a valid routing token and said routing token 
is not old, computer readable program code for forwarding, by said network dispatching 
mechanism, the request, including the URL, to the particular server indicated by said valid 
routing token (column 1, lines 53-67 and column 6, lines 63-67 and column 9, lines 25-37 of 
Eldridge et al. (6,515,988)). Therefore it would have been obvious to one of ordinary skill in the 
art at the time the invention was made to further modify the method for maintaining a state for a 
user session using a global session server by Courts et al. by having a routing token because this 
notifies the system of the type of encryption information to use to encrypt the packet and the 
validity of the packet. 

Referring to claim 22, Courts et al. teaches a network dispatcher for establishing a 
persistent relationship between an end user device and a server where the server is one of a 
plurality of servers managed by said network dispatcher (column 3, lines 5-7 of Courts et al.), 
said network dispatcher comprising: means for receiving a request for information from said end 
user device, said request for information including a uniform resource locator (URL) (column 5, 
lines 66-67 of Courts et al.); means for determining which of the plurality of servers to select for 
satisfying said request for information (column 3, lines 5-7 and column 5, lines 66-67 of Courts 
et al); said key for accessing a storage area for information regarding the persistent relationship 
and the end user device (column 1, lines 45-50 of Courts et al.). 
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Courts et al. does not teach of creating a token. Eldridge et al. (6,515,988) teaches means 
for creating, at said selected server, a token comprising at least an identifier for the selected 
server, a date/time stamp, and a key, means for inserting the token into the URL; and means for 
sending, by the selected server, a response with the token inserted into the URL to the client 
device (column 1, lines 53-67 and column 9, lines 25-37 of Eldridge et al. (6,515,988)). 
Therefore it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to further modify the method for maintaining a state for a user session using a global 
session server by Courts et al. by creating a token because this notifies the system of the type of 
encryption information to use to encrypt the packet. 

Regarding claim 6, 17, and 27, Courts et al. teaches a method [a computer program 
product and a network dispatcher] as claimed in claim 1, 12, and 22 wherein said information 
regarding the persistent relationship is stored as a cookie on said server (column 5, lines 50-52 of 
Courts et al.). 

3. Claim 3-5, 14-16, and 24-26 rejected under 35 U.S.C. 103(a) as being unpatentable over 
US Patent No. 6,076,108 to Courts et al. in view of Eldridge et al. (6,515,988) as applied to 
claim 1, 2, 6, 7, 12, 13, 17, 18, 22, 23, and 27 above, and further in view of Vanstone et al. 

Regarding claim 3, 14, and 24, Courts et al. in view of Eldridge et al. (6,515,988) a 
method [a computer program product and a network dispatcher] as claimed in claim 1,12, and 
22 and tokens (column 1, lines 53-67 of Eldridge et al. (6,515,988)). 

Courts et al. in view of Eldridge et al. (6,515,988) does not teach checksum or hash 
verification field. Vanstone et al. teaches wherein said token has a checksum or hash verification 
field (column 2, lines 54-58 of Vanstone et al.). Therefore it would have been obvious to one of 
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ordinary skill in the art at the time the invention was made to further modify the method for 
maintaining a state for a user session using a global session server by Courts et al. in view of 
Eldridge et al. (6,515,988) by having checksum or hash verification field because this helps in 
identifying the client. 

Referring to claim 4, 15, and 25, Courts et al. in view of Eldridge et al. (6,515,988) 
teaches a method [a computer program product and a network dispatcher] as claimed in claim 3, 
14, and 24 (column 1, lines 53-67 of Eldridge et al. (6,515,988)). 

Courts et al. in view of Eldridge et al. (6,515,988) does not teach said hash is a SHA-1 
hash. Vanstone et al. teaches wherein said hash is a SHA-1 hash computed over said identifier 
for said selected server, said date/time stamp, and said key (column 2, lines 40-41 of Vanstone et 
al.). Therefore it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to further modify the method for maintaining a state for a user session using 
a global session server by Courts et al. in view of Eldridge et al. (6,515,988) by having said hash 
is a SHA-1 hash because this helps in identifying the client and SHA-1 is a type of hash function. 

Referring to claim 5, 16, and 26, Courts et al. in view of Eldridge et al. (6,515,988) 
teaches a method [a computer program product and a network dispatcher] as claimed in claim 3, 
14, and 24 and Base64 encoding (column 7, lines 11-16 of Eldridge et al. (6,515,988)). 

Courts et al. in view of Eldridge et al. (6,515,988) does not teach of checksum or hash. 
Vanstone et al. teaches wherein said checksum or hash (column 2, lines 56-58 of Vanstone et al.) 
is encoded. Therefore it would have been obvious to one of ordinary skill in the art at the time 
the invention was made to further modify the method for maintaining a state for a user session 
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using a global session server by Courts et al. in view of Eldridge et al. (6,515,988) by having 
checksum or hash because this helps in identifying the client. 

4. Claim 8, 9, and 19 rejected under 35 U.S.C. 103(a) as being unpatentable over US Patent 
No. 6,076,108 to Courts et al. in view of Eldridge et al. (6,515,988) as applied to claim 1, 2, 6, 7, 
12, 13, 17, 18, 22, 23, and 27 above, and further in view of Colby et al. 

Regarding claim 8 and 19, Courts et al. in view of Eldridge et al. (6,515,988) teaches the 
method [The computer program product] as claimed in claim 7 and 18 and the URL (column 5, 
lines 66-67 of Courts et al ). 

Courts et al. in view of Eldridge et al. (6,515,988) does not teach of filtering. Colby et al. 
teaches wherein additional filtering of the URL is done prior to the forwarding step (column 12, 
lines 6-7 of Colby et al.). Therefore it would have been obvious to one of ordinary skill in the art 
at the time the invention was made to further modify the method for maintaining a state for a 
user session using a global session server by Courts et al in view of Eldridge et al. (6,515,988) 
by filtering because this helps to authenticate the information more and also to retrieve more 
needed information from the packet. 

Regarding claim 9, Courts et al. in view of Eldridge et al. (6,515,988) teaches the 
methods claimed in claim 1 thru 8 and the dispatcher (column 3, lines 5-7 of Courts et al.). 

Courts et al. in view of Eldridge et al. (6,515,988) does not teach of filtering. Colby et al. 
wherein all filtering (column 12, lines 6-7 of Colby et al.) is performed within the dispatcher. 
Therefore it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to further modify the method for maintaining a state for a user session using a global 
session server by Courts et al. in view of Eldridge et al. (6,515,988) by filtering because this 
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helps to authenticate the information more and also to retrieve more needed information from the 
packet. 

5. Claim 10 and 20 rejected under 35 U.S.C. 103(a) as being unpatentable over US Patent 
No. 6,397,261 to Eldridge et al. (6,397,261) in view of Courts et al. 

Regarding claim 10, Eldridge et al. (6,397,261) teaches a method of sending information 
to a requesting end user from an application over a session wherein said application resides at 
one of a plurality of redundant servers, said method comprising the steps of: receiving response 
information from said application, said response information including a URL (uniform resource 
locator) (column 5, lines 15-24 of Eldridge et al. (6,397,261)); determining if a key cookie has 
been used for storing session information between said end user and said application; if a key 
cookie has been used for storing session information, retrieving a session key from said key 
cookie; if a key cookie was not used for storing session information, retrieving said session key 
from a control block removing all cookies from said response information; storing said removed 
cookies in a predetermined storage area; updating a date/time stamp in said sticky routing string 
inserting said sticky routing string into said URL; and transmitting said response information, 
including said URL, to said end user (column 2, lines 34-63 of Eldridge et al. (6,397,261)). 

Eldridge et al. (6,397,261) does not teach a network dispatcher or a sticky routing string. 
Courts et al. does teach redundant servers residing behind a network dispatcher (column 3, lines 
5-7 of Courts et al.) updating said URL to indicate the removal of said cookies (column 1, lines 
55-56 of Courts et al.); creating a sticky routing string (column 6, lines 6-8 of Courts et al.). 
Therefore it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to further modify the method for dynamic use and validation of http cookies for 
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authentication by Eldridge et al. (6,397,261) by having a network dispatcher or a sticky routing 
string because a dispatcher is needed to pass the packet to the server and sticky routing strings to 
help route request from the same client to the same server. 

Referring to claim 20, Eldridge et al (6,397,261) teaches a computer program product 
having computer readable program means sending information to a requesting end user from an 
application over a session wherein said application resides at one of a plurality of redundant 
servers, said computer program product comprising: computer readable programming means of 
receiving response information from said application, said response information including a URL 
(uniform resource locator) (column 5, lines 15-24 of Eldridge et al. (6,397,261)); computer 
readable programming means of determining if a key cookie has been used for storing session 
information between said end user and said application; if a key cookie has been used for storing 
session information, computer readable programming means of retrieving a session key from 
said key cookie; if a key cookie was not used for storing session information, computer readable 
programming means of retrieving said session key from a control block; computer readable 
programming means of removing all cookies from said response information; computer readable 
programming means of storing said removed cookies in a predetermined storage area; computer 
readable programming means of updating a date/time stamp in said sticky routing string; 
computer readable programming means of inserting said sticky routing string into said URL; and 
computer readable programming means of transmitting said response information, including said 
URL, to said end user (column 2, lines 34-63 of Eldridge et al. (6,397,261)). 

Eldridge et al. (6,397,261) does not teach a network dispatcher or a sticky routing string. 
Courts et al. does teach redundant servers residing behind a network dispatcher (column 3, lines 
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5-7 of Courts et al.) computer readable programming means of updating said URL to indicate the 
removal of said cookies (column 1, lines 55-56 of Courts et al.); computer readable programming 
means of creating a sticky routing string (column 6, lines 6-8 of Courts et al.)- Therefore it would 
have been obvious to one of ordinary skill in the art at the time the invention was made to further 
modify the method for dynamic use and validation of http cookies for authentication by Eldridge 
et al. (6,397,261) by having a network dispatcher or a sticky routing string because a dispatcher 
is needed to pass the packet to the server and sticky routing strings to help route request from the 
same client to the same server. 

6. Claim 1 1 and 21 rejected under 35 U.S.C. 103(a) as being unpatentable over US Patent 
No. 6,374, 359 to Eldridge et al. (6,397,261) in view of Courts et al. as applied to claimlO and 20 
above, and further in view of Colby et al. 

Regarding claim 11 and 21, Eldridge et al. (6,397,261) in view of Courts et al. teaches a 
method [a computer program product] as claimed in claim 10 and 20 and said response 
information (column 1, lines 53-55 of Courts et al). 

Eldridge et al. (6,397,261) in view of Courts et al. does not teach of filtering. Colby et al. 
wherein, prior to said determining step, said response information is transmitted from said 
application through one or more filters (column 12, lines 6-7 of Colby et al.). Therefore it would 
have been obvious to one of ordinary skill in the art at the time the invention was made to further 
modify the method for dynamic use and validation of http cookies for authentication by Eldridge 
et al. (6,397,261) in view of Courts et al. by filtering because this helps to authenticate the 
information more and also to retrieve more needed information from the packet. 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to April L Baugh whose telephone number is 703-305-53 17. The 
examiner can normally be reached on Monday-Friday 8:30am-5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal D Dharia can be reached on 703-305-4003. The fax phone number for the 
organization where this application or proceeding is assigned is (703) 872-9306. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is 703-305-3900. 
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